545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent
Summary: XRanges for AI, built by CTF.ae, deploys instrumented multi-service target applications and scores an autonomous security agent live on four independent signals: coverage, boundaries, exploited vulnerabilities, and integrity. The platform was stress-tested at DEF CON 34's Bug Bounty Village in August 2026, where 545 registered players each received an isolated copy of a fictional AI company called Xenoptic and the platform watched all of them across 850+ deployments over 48 hours.
What's compelling: An agent's report reads identically whether it exploited a flaw, brushed past it, or invented it, and a single run proves very little - which is why the platform records boundary violations like revoked API keys with container and timestamp, and treats those as findings about the agent rather than the target.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026